diff --git a/dep_freshness/_tables.py b/dep_freshness/_tables.py
index cd2e354..c165241 100644
--- a/dep_freshness/_tables.py
+++ b/dep_freshness/_tables.py
@@ -77,11 +77,15 @@ MANIFEST_GLOBS: Final = (
 )
 REQUIREMENTS_PATTERN: Final = r"^requirements.*\.txt$"
 
+# `.utils` is where every CI workflow checks the shared gate out, INSIDE the
+# repo being checked. Without it `--all` walks utils' own manifests and fails
+# the consuming repo for staleness in a directory that repo does not own --
+# which is exactly how punchme's first green local run turned red in CI.
 EXCLUDED_DIRS: Final = frozenset({
     ".git", "node_modules", "build", "dist", ".dart_tool", ".venv", "venv",
     "__pycache__", "target", "vendor", ".gradle", "ios", "macos", "windows",
     ".mypy_cache", ".pytest_cache", ".ruff_cache", "coverage", "htmlcov",
-    ".idea", ".vscode", "Pods", ".fvm",
+    ".idea", ".vscode", "Pods", ".fvm", ".utils",
 })
 
 # --- Constraint policy ------------------------------------------------------
diff --git a/dep_freshness/tests/test_discover.py b/dep_freshness/tests/test_discover.py
index aed7ff0..a569ffe 100644
--- a/dep_freshness/tests/test_discover.py
+++ b/dep_freshness/tests/test_discover.py
@@ -43,6 +43,18 @@ def test_excluded_directories_are_skipped(repo):
     assert find_manifests(repo) == []
 
 
+def test_the_shared_gate_checkout_is_not_part_of_the_repo(repo):
+    """CI clones kuhyx/utils into `.utils/` inside the repo being checked.
+
+    Without this exclusion `--all` walks utils' own manifests and fails the
+    consuming repo for staleness in a directory it does not own -- which is
+    how punchme's first green local run turned red in CI.
+    """
+    write(repo, ".utils/design_system/pubspec.yaml", PUBSPEC)
+    write(repo, "pubspec.yaml", PUBSPEC)
+    assert [str(p) for p in find_manifests(repo)] == [str(repo / "pubspec.yaml")]
+
+
 def test_git_ignored_manifests_are_skipped(repo):
     write(repo, ".gitignore", "generated/\n")
     write(repo, "generated/pubspec.yaml", PUBSPEC)